With rootdn added, I now have a working 2.4.X slave with a 2.3.38 master
via delta-syncrepl.

Can you remind me what you can write to in cn=monitor with a rootpw
setting? I'm sure ando told me and I'll go dig in the archives.

Off the top of my head, you can modify the server's debug level, as well as the
read-only setting for any database. (Same caveat about the read-only flag
applies as for cn=config though - if you set the frontend to read-only, you
can't make any more modifications, so you can't toggle it back again without
restarting the server.)
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/